Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Long-Term Liability For One-Time Security Breaches?

Soulskill posted about 4 years ago | from the neverending-can-of-worms dept.

Privacy 119

An anonymous reader writes "Not a month goes by where we don't hear about a theft of some organization's laptop containing sensitive personal information, not to mention the even more frequent — but often kept secret — breaches into company networks and databases. It is definitely true that you should be responsible for the security of your information when you handle it, but what happens when the theft of your information is not your fault? You have handed over this information to a company or organization and trusted them to keep is secure, but they failed. They might notify you of the breach or theft, and they might even set up a credit monitoring service for you for a year or two, but the problem is that this information may be used years from now. Is it fair that you have to worry for decades and pay for further credit monitoring when they are to blame for your information ending up in the wrong hands?"

cancel ×

119 comments

First Post (-1, Offtopic)

Anonymous Coward | about 4 years ago | (#32876466)

First Post

Information wants to be free (2, Interesting)

countertrolling (1585477) | about 4 years ago | (#32876546)

But we give it too much power to allow that. A much more fundamental change is needed. Until then, long term liability is probably the only alternative. It should never cost the victim anything at all. All costs should be laid on the leaker. And "Trust no one" with your info still applies.

Re:Information wants to be free (0)

DIplomatic (1759914) | about 4 years ago | (#32876772)

"Trust no one" with your info still applies.

I agree with you, but in this day and age I can't seem to go two days without some website asking for personal information. Whether I'm signing up for paperless billing from the electric company or ordering a pizza from papajohns.com. I don't use my real info whenever I can, but I couldn't tell you how many companies have my home address or phone number

Re:Information wants to be free (5, Funny)

Anonymous Coward | about 4 years ago | (#32877006)

Did you seriously just complain that you have to give out your home address in order to have something delivered to you?

Re:Information wants to be free (1)

wal9001 (1041058) | about 4 years ago | (#32877418)

I think he said you can't have pizza delivered without giving out your address.

Re:Information wants to be free (1)

AshtangiMan (684031) | about 4 years ago | (#32878268)

In this day and age.

Re:Information wants to be free (1)

hedwards (940851) | about 4 years ago | (#32876782)

Um, the only time I've had trouble with it is when my account was transferred to a new firm after acquision. Which makes it virtually impossible to account for without being psychic.

Re:Information wants to be free (5, Insightful)

fuzzyfuzzyfungus (1223518) | about 4 years ago | (#32877116)

The submitter of TFA(TFAS?) has swallowed the "identity theft" myth, and all its deliberately problematic implications, hook, line and sinker.

Whoever came up with the concept of "identity theft" needs to be given an award for sheer chutzpah, then clubbed to death. The problem isn't "identity theft", an "identity" in this context is simply a bunch of information that is only copied, not destroyed or removed when compromised. The problem is bank fraud and various other sorts of fraud perpetrated by people using those data, against institutions who, in a masterful display of doublethink, simultaneously ask you for your SSN when you do anything more sophisticated than taking 20 bucks out of the ATM and treat the SSN like a double-secret-super password that only you could possibly know, on the strength of which loans will be granted, accounts opened, and so forth.

However, by using the term "identity theft", the implication is created that you are the responsible party. As a token, whoever was responsible for the breach might be forced by law or bad PR to offer you a year of credit monitoring or something; but that doesn't address the root problem: banks, and other such institutions will accept laughably trivial factoids as incontrovertible evidence that somebody is you, and then try to stick you with the bag when the mistake is discovered. The problem isn't that somebody knows my mother's maiden name and my SSN, the problem is that numerous financial institutions and other such entities will happily accept possession of those facts as evidence that just about anybody is actually me. However, because it is "identity theft", I'm the one who has to watch my credit vigilantly forever, and wonder what might bubble up on a background check done in my name, rather than it being "bank fraud" or "inadequate police work", which would place the burden of responsibility on the party who ought to be responsible.

Between public records and massive data breaches, virtually all "identity" information is effectively public knowledge. Any institution who treats possession of that information as proof of identity should be treated as guilty of gross negligence, and responsible for the consequences. The idea that if those pesky consumers were just a little more careful, we wouldn't have this issue, is as elegantly malicious as it is utterly wrong.

Re:Information wants to be free (2, Insightful)

Timothy Brownawell (627747) | about 4 years ago | (#32877246)

Between public records and massive data breaches, virtually all "identity" information is effectively public knowledge. Any institution who treats possession of that information as proof of identity should be treated as guilty of gross negligence, and responsible for the consequences.

I assume you have a better idea, then? About the only thing I can think of is government-signed (and revokable, such as in case of theft/loss) physical tokens that can do public-key cryptography, which (1) is only recently somewhat feasible, and (2) might not be that great an idea given how intertwingled all the functions of the government are.

Re:Information wants to be free (3, Informative)

Anonymous Coward | about 4 years ago | (#32877520)

The system in place for internet banking in sweden is (usually) based around you being issued basically just ssuch a device. That is, you have a pin code (which is blocked after three wrong inputs) to log in to the device, and get a one-time code to log in with to the actual system. Any transaction are then further validated against the device, with transfers to a previously unknown person requiring you to not only validate the transaction, but the recipient as well.

However, this is not the whole truth, as what you describe is something government-signed, which this (as far as I know) is not. That is, the existance of the device is (in theory) only known by you and the bank, and used only to communicate with the bank. You may have several devices for several banks/accounts/roles, and although you are expected to show who you are when getting the account/device in the first place, this is something which is normal procedure in Sweden.

Two-factor authentication: it works, bitches.

Re:Information wants to be free (2, Insightful)

Anon-Admin (443764) | about 4 years ago | (#32877716)

Ok, a better idea. No more central credit reporting. They all rely on that, and it is exactly what the information leads to. So if every bank had to manage there own credit reporting and rely on there report with the customer then there would be no identity theft.

If the local branch of XYZ bank knows Joe Smith then it is hard for Jack to walk in and convince them that he is Joe. Add to it that Jack going to ABC bank and saying he is Joe does not get him any better chance of credit as he would have to take time and build a report with ABC Bank to get the credit.

Banks and many others seem to take the information in the three major credit agency files as golden and they rely on it for everything from loans to apartment rentals. The problem is that any information that is used to verify the identity of the person and connect them to the report can be found out and used by those who are less than honest. This leads to fraud and thus to issues.

Remove the three agencies and there is no more identity theft. When I have to work with the bank to build my credit at that bank it is hard for some one to steal it.

Re:Information wants to be free (3, Insightful)

fuzzyfuzzyfungus (1223518) | about 4 years ago | (#32877766)

I don't think that there is any one silver-bullet solution; I just think that the allocation of responsibility to the helpless rather than to the responsible is A)massively unjust and B) definitely does retard the development of better methods.

The fact that a bank will hand somebody a loan for some thousands because they know a couple pieces of biographic trivia about me is idiotic; but I am OK with that. It's their money, if they think that they can maximize profits by trading off security for convenience, more power to them. What really pisses me off, though, is that, after they do that, I am the "victim of identity theft" who has to watch his credit report forever, and fight an endless battle by certified mail with some Kafkaesque division of Equifax in order to rectify things. In a remotely just world, the response would be "You, a financial institution who really ought to know better, gave some guy ten grand because he knew a few pieces of public information? You dumb shit, I guess you are out the money."

There is no perfect defense against fraud; but I bet they'd come up with something better than what we currently have, if the costs fell on them.

Re:Information wants to be free (4, Funny)

Hognoxious (631665) | about 4 years ago | (#32878008)

In a remotely just world, the response would be "You, a financial institution who really ought to know better, gave some guy ten grand because he knew a few pieces of public information? You dumb shit, I guess you are out the money."

Actually, it should be "The CEO of your bank has agreed to waive the alleged debt, pay my outstanding legal and other costs and indemnify me against any future, plus an ex-gratia payment of fifty grand for my trouble. I have it in writing, with his photo ID right here. All witnessed and notarized".

You then hand over a note written with a crayon in childish writing, with a picture of a smiling face at the top and the bank officer's name scrawled underneath. In a different coloured crayon it says "it tru dat, signed my best pal", superimposed with a mucky handprint.

Well why not? Basically, that's what they've got against you.

Re:Information wants to be free (0)

Anonymous Coward | about 4 years ago | (#32878062)

Anyone choosing to use my mother's maiden name and my social security number to identify me does so at their own risk. Hundreds of individuals and corporations that I do not trust and that you should not trust have that information.

Re:Information wants to be free (1)

marcansoft (727665) | about 4 years ago | (#32878698)

A system like that got implemented in Spain a few years ago. All new Spanish national ID cards are smartcards which allow you to cryptographically sign documents with similar validity to a physical signature. It is expected that they will be increasingly used by banks and the like (and they are already being used in order to e.g. file tax documents on-line). The card is protected by a "PIN" (actually a password) and locks you out after a few incorrect attempts.

It's by no means perfect, but it will be interesting to see what comes out of it.

Re:Information wants to be free (0)

Anonymous Coward | about 4 years ago | (#32881216)

Any "single-signon" or equivalent ignores the major issues. Single "identity document", whether smartcard, or biometric comparison, or a simple passphrase, or ... is effectively a "single-signon".

* Identity is not authorization -- it might LEAD to authorization, but should at a maximum, allow access to a current role declaration.

* But, identity generally ignores current role(s), allowing cross-overs, and more and more so, the more complex the id-role-auth ties go. At worst is a "single-signon" that gives automatic simultaneous access to ALL roles authorized to that identity. Even with a "capability management", the background checking quickly becomes an expanding universe to manage (ultimately by SOMEBODY's foresight).

* Authorization is tied to role AND identity, in most valid situations, plus (current) need-for-access.

Take the traditional examples of database access rule evasion, and compare: Joe is identified by . Joe is authorized under role#1 to do A. Joe is authorized under role#2 to do B. BUT automation run as Joe under role#1, is NOT authorized to do B, and some A things authorized under role#1, are forbidden access under role#2.

Re:Information wants to be free (1)

profplump (309017) | about 4 years ago | (#32879518)

How about requiring a notary public's seal on loan documents for them to be enforceable? That would require lending institutions to reasonably verify someone's identity before issuing them credit, and works with 17th century technology.

It's not impossible to fool -- you could also have false ID, etc. -- but it's a lot more reliable than simply writing down a different SSN, and requires an additional fraud against the government to pull off.

Re:Information wants to be free (1)

Timothy Brownawell (627747) | about 4 years ago | (#32879620)

With everything moving to online (or sometimes fax), I'd think you could just get something notarized and scan it to get a digital copy of the notary seal that you could paste over your document image. Still, I suppose that is more work than just entering a couple numbers and would take more skill to automate.

Re:Information wants to be free (1)

mandelbr0t (1015855) | about 4 years ago | (#32879724)

banks, and other such institutions will accept laughably trivial factoids as incontrovertible evidence that somebody is you, and then try to stick you with the bag when the mistake is discovered.

Not to mention that it's more of an annoyance to the end user than it is security. I can never remember exact capitalization/spacing/punctuation to those "security questions". And sometimes I wonder if there's someone out there, compiling a list of these trivial factoids. One day, they will know more about me than I do myself.

It's the same story it's been for the last decade. Massive problems with current methods of government/financial institution/credit bureau validating your identity, better technicial solutions exist, but are expensive to implement, and require skilled individuals to do so. Most large organizations would rather make it a legal problem than hire people capable of making the transition. Of course, the enforcement has been a problem for a long time. And so the cycle continues, until those who are employed are more skilled than those who are not. In addition, proposed changes usually involve some kind of central government ID database that includes your retinal scan, fingerprints, DNA and some frozen zygotes. No wonder this news seems like it's from the nineties -- that's where the government still is.

Re:Information wants to be free (1)

fuzzyfuzzyfungus (1223518) | about 4 years ago | (#32880062)

No need to wonder [epic.org] if there is somebody out there.(though they are no longer an independent entity, having merged with Lexis-Nexis under the Reed Elsevier banner, thus assembling an even more comprehensive collection...)

Re:Information wants to be free (1)

Comrade Ogilvy (1719488) | about 4 years ago | (#32881286)

It is even worse than you indicate.

As a twice victim of identity theft (once stolen checks, once false credit cards), I have strong circumstantial evidence that "insiders" were involved in both cases. One might wonder if that is not the norm...

Vigilance can only limit the damage. If the criminals are within the banking/credit system, it is not even theoretically possible for you to fully protect the banks from themselves in your name.

Based on my experience I am a strong believer in NEVER using debit cards. The inherent weakness of debit cards is that they take money right out of your bank account.

A credit card company has a strong incentive to reasonable in resolving disputes: if push comes to shove, you can simply walk away from debt you deem fraudulent (and the burden of proof and costs of getting the court case rolling will be on their shoulders). This level of indirection protects you, and allows you to put food on the table and gas in the car while straightening out the mess.

A bank has a strong incentive to screw you over with regards to debit cards: any monies that have falsely left your account are costs they may have to eat. Banks will swear up and down that debit cards offer "all the protections" of credit cards. At one time that was close to true. Sort of. But when someone ugly goes wrong with your checking account, it is easy to rack up lots of late fees quickly left and right. And the banks are happy to label straightening these issues your problems, while hemming and hawing over whether you get access to any of the money that should be rightfully in your account.

Fradulent credit card debt is a "paper" problem, and have future headaches. Debit card fraud can mean you are truly screwed in the here and now.

Re:Information wants to be free (1)

Jason Levine (196982) | about 4 years ago | (#32882366)

The problem isn't that somebody knows my mother's maiden name and my SSN, the problem is that numerous financial institutions and other such entities will happily accept possession of those facts as evidence that just about anybody is actually me.

Of course, sometimes the thief doesn't know the right mother's maiden name and the financial institution still approves the new line of credit.

And then the thief changes the address immediately (before the card is even activated) and the financial institution doesn't red flag it.

And then the thief tries to get a $5,000 cash advance and the financial institution denies it but doesn't red flag the activity.

And, when the fraud is discovered (thanks only to the thieves paying to get rush-delivery of the card and financial institution sending it out before the address change went through), the financial institution refuses to give any information to the victim because the victim "might go and shoot the person and then we'd be liable." (Actual quote)

And when the police contact the financial institution, they might give them the runaround also.

Yes, this happened to me and this is why I won't do business with that financial institution *cough*Capital One*cough* ever again.

Is it fair? (0, Flamebait)

fyngyrz (762201) | about 4 years ago | (#32876608)

No. Who told you life was fair?

You're responsible for protecting yourself. Don't expose your data unless you need to; then change it if you can. Don't put your money where it can be stolen. Etc. (Wo)Man up. The world is not here to wrap you in cotton balls.

Re:Is it fair? (2, Insightful)

Soilworker (795251) | about 4 years ago | (#32876778)

Yes, seriously, if the informations is that important, why is it on a unencrypted laptop HDD ??

Re:Is it fair? (3, Insightful)

shentino (1139071) | about 4 years ago | (#32877210)

Not everyone has the choice to "man up".

I could go on numerous examples but the biggest would be mandatory disclosure of information to an incompetent government.

And don't even think of telling me that "I could always choose to go to jail" when doing so means I get my prints and mug shot forcibly taken anyway.

Re:Is it fair? (1, Insightful)

Anonymous Coward | about 4 years ago | (#32878138)

No. Who told you life was fair?

You're responsible for protecting yourself. Don't expose your data unless you need to; then change it if you can. Don't put your money where it can be stolen. Etc. (Wo)Man up. The world is not here to wrap you in cotton balls.

Yes. Don't ever accept a job (you'll have to show some sort of ID.) Likewise, don't ever open an account with a bank or credit union. Don't ever attend an institution of higher learning.

As for living, just move into a cardboard box. Not only is it cheap, which you'll need with no job, but you'd need to provide tax information to buy a residence, and apartments won't lease to you without some sort of proof employment, which you won't have. Or move to some third-world country and live in a shack.

And for best results, cover your shack or box in tinfoil. Also, consider making a hat....

It's your information, sheeple! Don't just fritter it away for the trappings of modern conveniences!

30 million illegals prove it isn't so (1, Informative)

Anonymous Coward | about 4 years ago | (#32879226)

There are thrity million illegal aliens in the US. They work without showing ID or showing laughable ID. I have personally watched one open a bank account without showing a single blessed thing. Stood right there and watched the entire sign up process, the bank did NOT ask for any ID, took the illegals word on everything, and had a convenient foreign language speaker teller do the assisting. I was three feet away standing in line, saw it happen. They get drivers licenses in a lot of places, and all sorts of other goodies, can open any utility service they want, etc. free medical care for any sniffle at any emergency room. Free schooling for their anchor babies. The feds are now going to sue a state to keep that "no ID verification needed" practice up and running. They can sign up for and receive free or heavily subsidized college education, whereas legal citizens have to pay through the nose and show valid ID.

ID that is even remotely verifiable is only for the legal honest citizens, if you are illegal, the government doesn't seem to care very much. Heck, they will arrest (for committing some nasty crime) and deport illegals numerous times in a row, but they still come back and can do whatever they want, no ID of any consequence or verification required. ID is the last thing they worry about, it's a joke.

Re:Is it fair? (0)

Anonymous Coward | about 4 years ago | (#32880672)

I just received notification that my medical insurance company's data was breached. Obviously this includes address, credit card information, Social Security number and such, but it also includes my entire medical history. How would you suggest that I go about keeping my medical data away from the insurance company and/or change it after sharing?

I agree life isn't fair and I accept that f'd up things happen, but I fail to see how any of the responsibility is mine.

And a bunker too... (1)

bragr (1612015) | about 4 years ago | (#32876506)

Well you could always change all the numbers and important information that you can. After that I recommend praying to your favorite diet(y|ies). That or keeping all of your money in a shoebox under your bed.

fair? (1, Troll)

Michael Kristopeit (1751814) | about 4 years ago | (#32876572)

Is it fair that you have to worry for decades and pay for further credit monitoring when they are to blame for your information ending up in the wrong hands?

you're demanding fair credit? what gives you the right? you don't have any credit. if you want credit, there are terms. if you don't like the terms, you don't get credit. this has nothing to do with "fair".

Re:fair? (1)

SpongeBob Hitler (1848328) | about 4 years ago | (#32876802)

Is it fair that you have to worry for decades and pay for further credit monitoring when they are to blame for your information ending up in the wrong hands?

you're demanding fair credit? what gives you the right? you don't have any credit. if you want credit, there are terms. if you don't like the terms, you don't get credit. this has nothing to do with "fair".

Well, if someone uses your personal info to get a big loan in your name that you then have to pay back, it can be a bit of a problem. Sorry if understanding simple things like this is too difficult for you.

Re:fair? (1)

madddddddddd (1710534) | about 4 years ago | (#32879768)

so you think i don't understand... when i said that credit shouldn't be expected to be fair.... and to explain why you think i don't understand, you point out an example of gross unfairness... i agree with you... credit is often not fair.

so in your world where people are given credit, there would never be any bit of a problem. good luck with that. i'm sure living in your fantasy land isn't too difficult for you.

Re:fair? (1)

mcgrew (92797) | about 4 years ago | (#32878482)

Let me guess... the bank you're CEO of got a government bailout?

Contract (3, Insightful)

decipher_saint (72686) | about 4 years ago | (#32876590)

Not to sound condescending, but when you hand your stuff over to a third party generally there is a contract signed between you and them, what you are looking for *should* be in that contract.

Re:Contract (1)

morgan_greywolf (835522) | about 4 years ago | (#32876792)

Contracts simply state what is agreed to, and to some extent, what happens when what specifically agreed-to elements of the contract are not met -- usually this mostly means termination of the agreement. Contracts might contain verbiage about keeping data and equipment secure; if security is breeched, that's where the contract ends and liability law begins.

When someone makes a mistake and a laptop gets stolen because someone failed to secure it properly, this is called 'negligence' and it's an actionable tort, meaning people get sued. If the laptop contained sensitive data, such as credit card information or other sensitive financial data, and that data was secured, then the owner of laptop bears some responsibility as well. That's where they would get sued by their customers for negligence.

But I'm not a lawyer and you should definitely pay for a competent attorney anytime something like this comes up.

Re:Contract (1)

morgan_greywolf (835522) | about 4 years ago | (#32876822)

s/data was secured/data wasn't secured/

Re:Contract (0)

Anonymous Coward | about 4 years ago | (#32878020)

I don't know about these security people hauling laptops around. I know that if I were put in charge of keeping a laptop safe, I'd encrypt the hell out of it, and sleep with it handcuffed to myself.

O RLY? (0)

Anonymous Coward | about 4 years ago | (#32878042)

Not to sound condescending, but when you hand your stuff over to a third party generally there is a contract signed between you and them, what you are looking for *should* be in that contract.

Really?

Do you have such a contract with your bank/financial institution?
The school/university you last attended?
Your employer?
Your local/state/provincial/national government?

Yes, I'm sure they all have privacy policies, which all boil down to "We'll do our best, but if we screw up, sucks to be you." What is your recourse under the "contract" if the entity violates its stated policy as a result of negligence on the part of its employees?

Re:O RLY? (1)

decipher_saint (72686) | about 4 years ago | (#32878262)

Having dealt with a few offsite storage places I can tell you that they have SLAs that cover theft/fire/nuclear bombs/etc.

Re:O RLY? (0)

Anonymous Coward | about 4 years ago | (#32879528)

Having dealt with a few offsite storage places I can tell you that they have SLAs that cover theft/fire/nuclear bombs/etc.

You're ignoring the question. Do you have such an agreement with every third party you do business with, including schools, employers, and governments?

Because those institutions have breaches, too. Your SLA with AcmeDataCorp is pretty meaningless when your bank gets hacked, or when your employer's HR database is copied to an executive assistant's laptop and left on a bus.

A nice point. (1, Interesting)

Anonymous Coward | about 4 years ago | (#32876624)

Ironically, the four UK Credit Reference Agencies have announced today that you can do a web based credit check on youself for the sum of £2.00. PReviously only one of them allowed web one time (ie non annual contract) checks.

If they make it quick and also cheap then maybe more people will take responsibilty for checking their own details on a regular basis.

Posting anon for obvious reasons....

Re:A nice point. (1)

MoonBuggy (611105) | about 4 years ago | (#32877030)

Quick question: is it worth getting the statutory £2 report from all of the companies (incidentally, the ICO only lists [ico.gov.uk] three) or will it be sufficient to go with one?

Not that it particularly matters at £2 per go, I suppose, but it'd still save some time if it turns out they're all working from shared info.

Re:A nice point. (1)

Zerth (26112) | about 4 years ago | (#32877628)

They don't necessarily have the same info and they definitely don't share "this is bogus information" notices. They are competitors.

Re:A nice point. (1)

Sir_Lewk (967686) | about 4 years ago | (#32877380)

Posting anon for obvious reasons....

Yes of course, perfectly understandable.

the real reason (2, Interesting)

Bizzeh (851225) | about 4 years ago | (#32876628)

the real reason we hear more about it and hear of more of them every day is because they are the media topic of the moment, just like when northern rock was in trouble, suddenly, all the banks where in trouble and everyone took their money and caused the financial meltdown.

in short, this sort of thing isnt happening more frequently than it previously was, its just being reported on more

Re:the real reason (0)

Anonymous Coward | about 4 years ago | (#32877860)

What evidence can you present that the frequency of such events is not increasing?

Two oddities (2, Insightful)

vlm (69642) | about 4 years ago | (#32876644)

The first oddity is why the author believes that the data would sit around for years before being used. Like there's an "exploit bank" where you can deposit your collection of stolen data and gain interest on it until you "cash them in". I'd think far more likely it'll get used fairly rapidly, or never. How you fence or launder millions of records is kind of a mystery to begin with.

The second oddity is we are mostly dealing with the bottom percentiles of personnel, equipment, hardware, software, and design. So the article blissfully dreams "Let's hope that these reasonable measures will include the use of encryption." But you know that fools are just going to add another column to the database called "encryption key" so as to decode the other columns. Or store the key in C:\key.txt. Or go all ROT-13 or whatever the unicode version is of ROT-13. If you're dealing with screwups, adding more conditions just makes their screwups more rube goldberg and hilarious, it doesn't prevent them from screwing up.

Re:Two oddities (1, Insightful)

Anonymous Coward | about 4 years ago | (#32876866)

Yeah, I agree. Also this falls into the category of "Yeah, so?". Lots of things are unfair, and yeah, we should probably try to change them, but the feasibility is the issue: most people have probably been part of some security breach in the past 30 years. Do we monitor credit for everyone? Okay, where does it end?

Also these credit monitoring services, while helpful, aren't foolproof. Just look at that lifelock jackass.

I'm not saying it isn't unfair - it is - it just seems a lot like wishful thinking, kind of like: WOULDN'T IT BE NEAT IF EVERYONE GOT ALONG AND THERE WASN'T WAR? WOULDN'T IT BE NEAT IF WE ALL HAD NO IDENTITY THEFT PROBLEMS DO TO MAGICAL CREDIT MONITORING SERVICES THAT WE GET FOR FREE? And if I had four wheels, I'd be a wagon...

Re:Two oddities (4, Insightful)

shentino (1139071) | about 4 years ago | (#32877242)

The problem is that identity theft is profitable for more than just the thief.

The credit bureaus make shitloads of money from identity thieves taking out loans and triggering credit reports.

Re:Two oddities (0)

Anonymous Coward | about 4 years ago | (#32880886)

One question is: WHY DO THEY HAVE A RIGHT TO THE INFO (those who collect and archive it). Why should Experian, Equifax, TransUnion, ChoicePoint have such numbers on file AT ALL (or any info, for that matter)? Why should you not have the same right to confirm what ChoicePoint has on you, that the other 3 are forced to release (at least yearly)? The US issued Social Security numbers under the guise of only for Social Security use. Then came the IRS. Then came "use SSN in all transactions with the government", which is slightly later relaxed. So why is it legal for anybody but the person and those organizations that MUST report income for Social Security reasons even allowed to collect the numbers. Why, for example, does even Medicare use the same identification number?

Start over with personal identification numbers. Make use of "approximate date and place of birth" plus "last 4" plus rainbow tables meaningless. STOP issuing SSNs to anybody who is ineligible to pay-in, or collect Social Security.

How many businesses that you deal with, use at least that vulnerable last-4 as if it's OK? Why do you still deal with them?

Re:Two oddities (4, Informative)

RobertM1968 (951074) | about 4 years ago | (#32876910)

The first oddity is why the author believes that the data would sit around for years before being used. Like there's an "exploit bank" where you can deposit your collection of stolen data and gain interest on it until you "cash them in". I'd think far more likely it'll get used fairly rapidly, or never. How you fence or launder millions of records is kind of a mystery to begin with.

There are - and it's been covered here, even if not called those terms. There are "organizations" that do nothing but collect this info and then sell it off over time to whoever wants to buy it. I'm sure they dont put expiration dates on their data, and will gladly sell you a collection of records with 10 day old data and 10 year old data, all mixed together.

Re:Two oddities (4, Informative)

Mr. Underbridge (666784) | about 4 years ago | (#32877118)

There are - and it's been covered here, even if not called those terms. There are "organizations" that do nothing but collect this info and then sell it off over time to whoever wants to buy it. I'm sure they dont put expiration dates on their data, and will gladly sell you a collection of records with 10 day old data and 10 year old data, all mixed together.

You beat me to it. Why would we expect exploit lists to differ substantially from marketing lists - and just how separated do we really think these groups are? I'd expect that data to get passed around like a bottle of cheap wine.

As to using it - it may be true that CC#s for exploitation are only used from "fresh" lists. But what about all your other data, depending on where they got it? You probably won't move due to this event. Your SSN won't expire - or if it does, you have bigger problems than identity theft. So yeah, if your ID gets out there it's not good news, and not something I'd expect to cease being a threat.

Incidentally, some might be surprised how long lists stay in the wild. I recall once getting snail mail spam addressed to the previous owner of the house. This wouldn't have been remarkable, except that *we'd* lived in the house 20 years or so.

Re:Two oddities (0)

Anonymous Coward | about 4 years ago | (#32879238)

Actually, fraudsters may wait until a CC# nears expiration date as an attempt to counter fraud detection systems.

Re:Two oddities (1)

mysidia (191772) | about 4 years ago | (#32876972)

A record "encryption key" column in a database is fine as long as that encryption key is (A) generated in a sufficiently strong manner that it cannot be guessed, for example a SHA256 hash of a strong shared key salted with a pseudorandom value and the record id, and (B) accompanied by an initialization vector generated from truly random data, and (C) the encryption key in the enc. key column is itself encrypted using a strong public crypto, and (D) the secret key is not stored in the database, is preferably controlled using a hardware crypto device, and only the application that needs the sensitive fields will be granted access to the particular fields associated with that particular application.

(Each application having its own API key and public/private key pair to submit requests to the security server to decrypt certain fields of certain records)

Re:Two oddities (1)

The Moof (859402) | about 4 years ago | (#32877602)

The first oddity is why the author believes that the data would sit around for years before being used

Some stolen information does. Credit cards and the like ("short term" data) usually is 'use as fast as possible' due to its nature (not going to be around long). However, when it comes to data that cannot be changed/very difficult to change, ie, Social Security Numbers, they sometimes sit around for years before ever being used.

My local paper ran an article about this a year or two ago. A man in his 20's apparently had his SSN stolen when he was 13, and it just started getting used. The paper covered it due to the credit institutions making the whole fight to repair his credit messy. The thieves know that this type of information isn't easily changed, so they can sit on it until it's useful.

Re:Two oddities (0)

Anonymous Coward | about 4 years ago | (#32877626)

The first oddity is why the author believes that the data would sit around for years before being used.

As the gouverment has made sure that that data does not expire there is no push to use it all at once.

Maybe the first-level crooks just lift the most rewarding results from them, and sell, when the offered price is right, the rest to second-level hoodlums.

You know, like what you would do yourself when you auction a bucket-load of unsorted stuff.

And by the way : there is no reason why emptying-out the account of a good target means it will happen only once. As the data does not expire the hoodlums *could* be hanging on to that data and try again in a few years

Like small-timers break in and steal some old stuff, only to come back a month or so later to steal the new stuff you bought to replace it.

Re:Two oddities (1)

mea37 (1201159) | about 4 years ago | (#32877836)

The first oddity is why you think data would stop being used after some finite time period.

The second oddity is that you clearly don't understand how corporate organizations use encryption on laptops once they decide to do it.

Re:Two oddities (0)

Anonymous Coward | about 4 years ago | (#32877974)

They may use corporate encryption for a bit, but next refresh later, most companies get tired of dealing with it and "forget" to have it enabled on the next line so it happens again.

So far, the only laptop encryption for the enterprise I've seen that doesn't add more hassles than it solves is BitLocker. Turn the TPM on, enable BL, store recovery key in the AD schema, call it done. If better security is wanted, you can have the TPM ask for a PIN (with an exponentially increasing delay between bad guesses of passwords) and/or demand a file off a USB flash drive. With a USB flash drive startup, if the laptop owner has the flash drive, the thief may have the laptop, but there is no feasible way (other than breaking AES) that they will be getting at the stored data. Perhaps add something like LoJack for the enterprise which has the ability to remote wipe, and that solves the problem of stray data on a stolen laptop.

TrueCrypt is great for individuals, but has very limited enterprise recovery capability.

fair, huh? (0)

Anonymous Coward | about 4 years ago | (#32876652)

Anyone asking if something is "fair" is clearly too young to realize nothing in life is fair :-)
The extent to which liability should be assumed on the part of the company responsible for the data breech is an appropriate question, but ... "fair" - LMAO. The point is not even worth considering

Re:fair, huh? (1)

shentino (1139071) | about 4 years ago | (#32877256)

Life isn't fair because the money men running the show make it that way.

Its a cost we all must bear (1, Insightful)

davidwr (791652) | about 4 years ago | (#32876656)

The more financial liability we push off to those who make the mistakes, the more we will pay in the costs of goods and services and/or the more companies will play organizational games like incorporating overseas or contracting out data-gathering to "independent third parties" who can simply file liquidation bankruptcy in the event of a too-expensive data breach.

Or, when that is not possible, goods and services may not be offered at all because no company will sell them at a price that the public will pay after factoring in liability costs.

Re:Its a cost we all must bear (1)

SpongeBob Hitler (1848328) | about 4 years ago | (#32876902)

The more financial liability we push off to those who make the mistakes, the more we will pay in the costs of goods and services and/or the more companies will play organizational games like incorporating overseas or contracting out data-gathering to "independent third parties" who can simply file liquidation bankruptcy in the event of a too-expensive data breach.

Or, when that is not possible, goods and services may not be offered at all because no company will sell them at a price that the public will pay after factoring in liability costs.

Great idea. Let's just let all corporations do anything they want. After all, we wouldn't want them to actually be accountable for anything, would we?

Re:Its a cost we all must bear (1)

Chowderbags (847952) | about 4 years ago | (#32877046)

Seriously? It would cost a fraction of what the board of directory on any of these companies makes in order to actually protect data. Not only that, but why is "well, the companies will just try to find ways around it" a good excuse for just letting them do what they want anyway. Yes, we might have to play whack-a-mole with some oddly structured corporations (huh, funny, this group of privately held corporations funneling money to each other is all run by the same group of people. Maybe we should look into that...). This whole notion that we must respect legal fictions and ignore reality when dealing with "artificial persons" is nonsense. When company A owns companies B, C, and D, we shouldn't let them sever all ties with B, C, and D at a whim (or as a shell game to avoid responsibility for their actions). I'm not saying we should go after the individual shareholders of a publicly traded company (because by and large they don't have any power), but I've no compunction against taking a good hard look at CEOs and the like when things get fishy.

Re:Its a cost we all must bear (2, Insightful)

mcgrew (92797) | about 4 years ago | (#32878640)

The cost of a company's mastakes are a cost of doing business. Why should I pay for your mistakes? I'd rather the company go out of business, even all companies like it, than let them continue with shoddy security that may cost me dearly. If they aren't made to pay for their mistakes, the mistakes will continue to be made.

You have morals, but corporations do not.

Re:Its a cost we all must bear (0)

Anonymous Coward | about 4 years ago | (#32881442)

> Why should I pay for your mistakes?

Ummm --- because the company (or government entity) is "too big to fail".

> You have morals, but corporations do not.

Corporate ethics generally require mitigation of damages. That may be inadequate security, when the financial risk of (e.g. breaches) is smaller than preventing those risks through enhancing security. Is it "morals"? Only to the extent that "morals" and "ethics" are synonyms. Corporations are not (with non-accessible and layered ownership) even people. Some trusts and corporations don't even have any truly fixed assets! Look at the layered securities on the market today.

        This investment trust will purchase securities with the proceeds of the public offering, after
        covering management expenses (but management will be abrogated, except for the "clerk" duties
        of e.g. reporting taxable income) after the first month of the offering. The securities purchased
        will (for the most part) be securities identical, or nearly so in nature, to the securities offered.
        [layer 2] ... keep digging, and you may find that NOTHING has any intrinsic value, or anything
        that does, doesn't ever come back to the investor, due to lack-of management, or mis-management.

> If they aren't made to pay for their mistakes, the mistakes will continue to be made.

Make the risk of breaches high enough, and the cost of inadequate risk management becomes high enough (whether liability insurance premiums, or government action) will indeed force changes in policy and procedures.

Posit: A retirement fund invests in mutual funds. They become majority owners of the mutual fund, and ORDER that the only thing they care about is growth of investment. (morals just got removed from the picture -- the
retirement fund USUALLY has only its depositors financial interests, and is quite following intended operations to express that to the fund(s) into which it invests. Similarly the mutual "spread-the-risk" funds, to their owners).

Contrast: An individual purchases shares of an operating company. The individual (subject to comparitive share counts, or joining with like minded other owners) may impose morals upon company operation, and replace directors and/or officers until those moral issues are resolved.

Screwup? (3, Insightful)

girlintraining (1395911) | about 4 years ago | (#32876784)

Your security should be more costly to bypass than what the security is protecting. If you can't do this, you're making a business proposition to the world: "Hey, free profit at my expense. Inquire Within." If you don't want to pay to protect it properly, then the best you can hope for is that someone else's stuff is more shiny than yours.

Re:Screwup? (2, Insightful)

ThosLives (686517) | about 4 years ago | (#32877010)

This isn't security in the first place. True information security would be a situation where even if someone had all your "authentication data" it wouldn't be possible to abuse. (I'm not claiming I know how to obtain such security, and I admit it is an idealized statement.)

It seems to me that the current situation we experience related to (financial) authentication is due to the fact that we have traded the necessity of actually knowing your banker or clients personally for what are essentially anonymous transactions. In the past, someone had to try quite hard to mimic your identity physically if they wanted to walk into a bank and raid your account, and they could only mimic one person at a time.

Now, all someone has to do is steal keys, so to speak, because nobody at the bank really knows who you are; all they have is a database entry. We have actually given up some control over our accounts for the "convenience" of forgoing relationships with our financial institutions.

As an aside, I actually hate the fact that this type of event is called "identity theft" because identity cannot be stolen. What is stolen (or copied or misappropriated or whatever) is authentication information, which is not the same thing as identity. It's very alarming to think that your authentication information and records define an identity.

The real problem with the system isn't that people can get your authentication information but that you can do too much with that authentication information.

Not your fault? (1)

bi$hop (878253) | about 4 years ago | (#32876832)

FTA:

You have handed over this information to a company or organization and trusted them to keep is secure, but they failed.

This *is* your fault. The moment you entrust your data to someone else, you are at their mercy--regardless of contracts, guarantees, and their best intentions. Mistakes are made, people are human.

Consumer Law 101 (0)

Anonymous Coward | about 4 years ago | (#32876842)

The 3 elements of the tort of negligence

1) did the respondent owe the complainant a duty of care?
2) did the respondent breach that duty
3) did that breach cause the complainant harm?

infinite lifetime considered harmful (4, Insightful)

khb (266593) | about 4 years ago | (#32876882)

That all of the really useful data tends to have infinite life (birthdate, SSN or equiv for non-US, place of birth) compounds the problem (the "use case" that comes to mind is some aged drive surfaces in the used parts market and some scofflaw procures it and uses it long after the breach itself).

Obviously, each organization should have their own ID numbers, and any given "customer" ID should be able to be associated with various time varying external credentials and really good stuff which isn't time varying shouldn't be in the hands of third parties.

Regulators (e.g. SOX, HIPPA, UK data protection act(s)) all seem to miss the boat about limiting the scope of breeches. Legislating that no breech ever occur is laudable, but impractical. So minimizing the harm done should be the focus.

when IRS or Social Security loses data? (1)

peter303 (12292) | about 4 years ago | (#32876916)

More a matter of when, not if, should a large government agency loses a massive amount of business records.

Their main protection is government systems are "self-encrypting", that is written mostly in pre-1980 OS-360 COBOL.

Of course (3, Insightful)

John Hasler (414242) | about 4 years ago | (#32876956)

> Is it fair that you have to worry for decades and pay for further credit
> monitoring when they are to blame for your information ending up in the
> wrong hands?

You are liable for the actions of your agents. If they screwed up you can sue them but you are still responsible to your customers.

They should be penalized for failure to disclose. (1)

jtownatpunk.net (245670) | about 4 years ago | (#32876960)

I'm 99.44% sure that my check card info was compromised in a data theft incident but I have no proof. One day, I got a call from my bank saying that my current check card was susceptible to fraud and that a new card had been sent to my mailing address. Please call if you have not received this card.

That set off a couple WTF questions in my head. First of all, it was implied that my replacement card should have arrived which means they'd sent it at least 2-3 days earlier. If fraudulent activity had been detected, they should have notified me immediately and blocked the Visa number. But I'd used the card the day before and that call was the first I heard about fraud.

I took a closer look at my account activity for the previous few months and every payment and credit was legit. I called my bank and spent almost an hour talking to several different people to get an explanation. The best I got was, "Well, they want to upgrade the gold check card holders to platinum." I asked if there would be a new Visa number and expiration date on the card because I had to update some autopayments if that was changing. "Nope. The number won't change." If that was the case, why couldn't they just wait another 6 months until my gold card expired? And why follow up the early mailing with a phone call talking about fraud?

So I went home and checked the mail. There was my new platinum check card with a new Visa number and expiration date. Why the new number? I'd had the old one for 12 years and it was burned into my brain.

So all I can figure is the details of my old card were lost in a security breach but hadn't been used yet. Why else would I get bumped to a new card 6 months early and a new Visa account number for the first time in over a decade? I'm sure if I pressed hard enough, I could get an answer but their first and second tier people are doing a good Sargent Schultz imitation and I'd wasted enough time on it.

But I shouldn't have to dig and probe. I should have received a letter with my new card explaining EXACTLY why the new card and account were necessary. The name of the processor that lost the data, the date/time the data was compromised, and the action taken against the company that lost the data.

Re:They should be penalized for failure to disclos (0, Flamebait)

XanC (644172) | about 4 years ago | (#32877268)

Anybody who uses a card with the Visa or MasterCard logo which is connected directly to his bank account (a so-called "check card") deserves what he gets.

important links (2, Informative)

Anonymous Coward | about 4 years ago | (#32877000)

TFA is the summary segued into mentioning the Data Accountability and Trust Act is before the Sentate. Here is the tracking site for that act, and the important Summary:
http://www.govtrack.us/congress/bill.xpd?bill=h111-2221 [govtrack.us]
http://www.govtrack.us/congress/bill.xpd?bill=h111-2221&tab=summary [govtrack.us]

It's fairly straightforward. It defines terms and requires the information holders to follow a structured method of protection and reporting. Places oversight with the FTC. Notably "Prohibits the FTC ... from requiring the deployment or use of any specific products or technologies." Does not mention encryption.

But also note this is hardly the first time such a bill has been presented.
http://www.govtrack.us/congress/bill.xpd?bill=h111-2221&tab=related [govtrack.us]

Nor is there mention of what bizarre shotgun-marriage legislation this bill is combined with, or indicates what kind of support there currently is for this bill.

I don't know... I'm horribly cynical about this sort of thing. But one good result might be that legislated and audited & enforced care of personal information (simple as name + credit card number) might finally make sites and services not just a little more careful with databases, but start to question whether they should have them at all. Right now, there's nearly no costs or responsibility overhead for collecting everything you can about your customers, and passers by. This bill makes it costly; that'll limit businesses to acquiring (and holding) only the information they need to conduct business.

Still, I'd like to see specific time limits on holding things like credit card number after a transaction, and very specific limit on sharing that information with "partners" etc. Also I'd like to see my "conduct business" above limited to processing the original transaction with you; that the personal information acquired cannot be used to make money in any other way whatsoever.

(Sorry for doing your job, Soulskill, by supplying those links. Perhaps you could add the car analogy?)

Why do they need so much private info anyway? (2, Insightful)

craftycoder (1851452) | about 4 years ago | (#32877016)

I feel that the information I share is at my own peril. Perhaps we should worry less about data security and invest more energy in learning how to get stuff done without the need to share important info in the first place.

Re:Why do they need so much private info anyway? (0)

Anonymous Coward | about 4 years ago | (#32877394)

What happened to the days of if someone had the cash, they bought whatever it was they wanted. End of transaction.

Probably the biggest reason is that stores not just want to make cash from what they sell, but also selling the information about who buys what they sell. For example, if every Ford dealer in a state buys a Vend a Goat machine for their waiting rooms, then some marketer would try to sell goats to anyone with a Mustang. So anonymous cash transactions denies a lot of retailers this money stream.

This is why certain brick and mortar retail stores used to require so much information just to buy a part until they had a consumer revolt on their hands.

NASD fines go back 5 to 10 years (1)

charnov (183495) | about 4 years ago | (#32877036)

The NASD has been known to levy multimillion dollar fines and pull dealer licenses for offenses made by previous staff. Their reasoning is that any competent professional would see and correct pre-existing issues. To be fair, they gave me and my staff 6 months to fix some stuff related to email auditing and retention and even made suggestions...

Independent ID-Checking Service (3, Insightful)

pwilli (1102893) | about 4 years ago | (#32877084)

This is probably about identity theft and getting e.g. loans by simply knowing the "magic" numbers of someone else's life.

Why is it still possible to get these things in the US without going into e.g. a bank and showing them a valid photo ID (passport, driver license, ...) to let them check if you are really the person you claim to be? Makes it a lot more difficult to get these things, and shifts liability back to the banks (if you can show you never went there to prove your identity, they screwed up by giving that loan - their fault).

If you've got a problem with a bank seeing you in person (why?), maybe a new institution could be founded that does only that: Check IDs of people for others. Like this:
1. Request a loan
2. Get a unique magic number of your bank that doesn't carry any information but the bank knows it belongs to you and that loan
3. go to the ID-check-service and let them sign that number, e.g. with: "Person xyz has proven his identity" (if paperwork, or better get a digital signature)
4. Give signed number back to the bank

Bank knows you are you, without you ever going there in person and the ID-check-service doesn't know what you needed that signature for (they just got a "random" number and signed it for a fee).

Expand this scheme for other services (governmental, etc.) and you get all the privacy you got now with a whole bunch of more security.

Google (1)

lymond01 (314120) | about 4 years ago | (#32877088)

We ditched Google for Faculty and Staff at our university and this was one of the reasons why. Too much information given to a third party and no true liability if some of it were lost or stolen. If you're working on potentially patentable research, and you send it through Google's servers, and some "glitch" lets someone else look at your email...well, you might have lost a patent. And Google doesn't pay. And Google could argue that, well, what do you want for free? At which point, we say, "Nothing, thanks. We'll move our services in-house." Which is what we're doing.

Truthfully, important documents don't belong on email. You can link to a password-protected SSL site from an email (like the certified email at the US Post Office) but attaching critical documents is just not a good idea.

The "secret information game" (5, Insightful)

erroneus (253617) | about 4 years ago | (#32877140)

This is a ridiculous game we keep playing over and over again. We have "secret information" we entrust to every business entity with which we do transactions. They aren't quite as secret any longer. And these other entities have people in them... not all of them can be trusted and you will never know who or how many whos have had access to the information. It's a very flawed system especially in light of modern communications technologies available today.

We need a system in which credentials for transactions are good for one-time-only. I present my credit/debit card and this information doesn't change again until either the expiration date arrives or I have it changed. But if I do something with my account "device" that issues a payment ticket number (rather like a cheque in many respects) that is then presented to the business entity to be used only by that business entity and only works once, twice or however often it can be used as approved by you. That code would only be useful for the other side of the transaction because of their encryption key token must work with the ticket number I issued. Then these stupid open secrets won't need to be a concern any longer.

The big problem isn't that people can or can't securely store this information because we already know it can't ever be stored safely and also be useful. So it needs to be stored "safely enough" but also with limited usability. What it all comes down to is a system that requires end-to-end user accountability. As it stands now, "identity theft victims" are held accountable for EVERYONE's mistakes. It's just not fair.

Re:The "secret information game" (1)

Zironic (1112127) | about 4 years ago | (#32878026)

As far as I know a number of banks offer virtualised credit cards with a specified limit and expiration date. If you generate those cards with the exact amount of money your transaction is worth then the card is useless their database gets hacked.

Re:The "secret information game" (1)

tool462 (677306) | about 4 years ago | (#32881382)

Yup. My bank offers this as well, and I've started making use of it after having some invalid charges show up on my account a couple of times. It's quite simple and useful, though only useful for online purchases.

Re:The "secret information game" (1)

cduffy (652) | about 4 years ago | (#32879274)

About a decade ago I got a research grant for a system for generating one-time per-transaction keys -- you had a card you carried with you with a display sufficient to display the price of the item you authorized and to allow a PIN to be entered if you wanted to approve a transaction; the card had a public identifier, a private key, and a counter; it generated a token consisting of the public identifier and a hash of the private key, the counter and the transaction data.

Didn't go anywhere -- not economically feasible -- and I may be misremembering some of the details, but the point is that the idea isn't new at all.

Re:The "secret information game" (1)

noidentity (188756) | about 4 years ago | (#32879554)

As it stands now, "identity theft victims" are held accountable for EVERYONE's mistakes. It's just not fair.

Actually, the victims of identity impersonation aren't even held accountable, which is why it keeps going on. The victims of course are the banks, who mistook someone else for you and gave out some of their money. They say it was you who are at fault, so they don't give a shit.

"Breach", not "Breech" (3, Informative)

natehoy (1608657) | about 4 years ago | (#32877194)

The correct term is "data breach", not "data breech."

A "breech" is either a pair of short pants ("breeches"), the hind end of the body or a birth where the baby is coming out backward ("breech birth"), or the rear of the barrel of a firearm.

So the term "data breech" means short pants made from data, data that is coming out of a system backward, or the back end of an Ethernet cable, I suppose.

This teaching moment sponsored a chunk of my karma from the inevitable "Offtopic" and "Troll" mods this post will undoubtedly earn me.

Re:"Breach", not "Breech" (1)

Cro Magnon (467622) | about 4 years ago | (#32878754)

Well, considering that companies are losing data out their rear-ends, maybe that spelling is more accurate than you thought.

Re:"Breach", not "Breech" (1)

natehoy (1608657) | about 4 years ago | (#32880312)

I find your argument... compelling. :)

credit history is a powerful weapon (0)

Anonymous Coward | about 4 years ago | (#32877196)

... that is clearly being misused by a section of the upper class against everyone below them.
It is a social wrong that must be collectively opposed by the public. If you do not agree to this point of view, you are either ignorant, gullible, blind or from the controlling upper class.

Thee points. (1)

gurps_npc (621217) | about 4 years ago | (#32877216)

1. We need to upgrade our personal information security rules. The standard right now is too low, in part because of the way we assign financial responsibility. By outsourcing it to credit card companies, who truly don't care because of the huge profits they make and relatively small cost of fraud, we have in effect allowed and encouraged ID theft. This needs to change.

2. If the financial fraud was all that mattered, then this wouldn't really be a big deal. But the huge problems certain people have when their credit is destroyed are not being properly dealt with by the courts. We need to modernize our credit laws to negate the personal problems created when fraud destroys someone credit history. Among other things, changing the rules for social security number re-issuing (right now this is very hard to do, even if fraud is proven).

3. This combination of lax credit companies encouraging fraud, then ignoring the huge personal problems because the financial cost is low needs to be dealt with. For example, we could pass a simple law that solves the problem in a two step manner: a) allow a second social security numbers to be issued to anyone willing to have their fingerprints, retina patterns, and photo attached to the new number, at a cost of $1000. b) Allow the consumer to force their credit card company to pay that $1000 if the company did not properly and ACTIVELY investigate any potential fraud. "We did nothing wrong" should not be enough, they need to do things right.

Re:Thee points. (1)

Haffner (1349071) | about 4 years ago | (#32877500)

You would really be willing to pay the government $1000 to permanently document your retinal prints? I certainly would not.

Re:Thee points. (0)

Anonymous Coward | about 4 years ago | (#32880996)

> You would really be willing to pay ...

    I wouldn't be willing to BE PAID $1000 (or any amount for that matter) to have my "permanent identifying information" collected by an organization, government or not. I will not work at a place that uses biometrics for identity checks.

Typical argument: What do you have to hide?

REAL answer: Whom should I trust to prevent digital forgery of my "unalterable identifying `prints'"?

FFS... (1)

Bigjeff5 (1143585) | about 4 years ago | (#32877336)

Is it fair that you have to worry for decades and pay for further credit monitoring when they are to blame for your information ending up in the wrong hands?

For fuck's sake, is it fair that someone stole your data in the first place? No, of course it isn't. But ultimately, it's your problem and nobody else's. Trying to make it someone else's problem is childish and irresponsible. They did their best (at least for the amount of money you spent on the service), but there hasn't been a security system invented that is 100% foolproof. So now you have to watch your information like a hawk because someone is a thief. You can hire that out too if you want, but there is a chance it will happen again. There was a chance it could happen even if you were managing your information security yourself. Thieves take shit that doesn't belong to them. It sucks but it's reality.

Life isn't fair - deal with it!

Christ.

Re:FFS... (1)

fuzzyfuzzyfungus (1223518) | about 4 years ago | (#32877612)

Your post is arguably correct in its claims; but really misses the point.

Yes, it is arguably the case that it is the submitter's fault that somebody made off with some personal trivia concerning him. However, are those trivia valuable in themselves? No. They are just some random chunks of data. Why are they valuable? Because all kinds of third parties will, idiotically, accept knowledge of them as being identical to being the submitter, and do things like hand out loans. The value and the danger of what would otherwise be some innocuous little strings are 100% the faults of various other parties, who treat them as being equivalent to identity because it is cheap and convenient, and then will turn around and smear the submitter's record when their own incompetence catches up with them.

Re:FFS... (1)

PeanutButterBreath (1224570) | about 4 years ago | (#32880208)

Its not even "arguably correct". If someone makes off with my SSN etc., even if it is my fault, having this information is not a crime AFAIK and I am neither culpable for exposing it nor a victim of someone obtaining it. The crime occurs when some other party is defrauded, and they are a victim of both the fraud and their own lack of diligence.

This only becomes a problem for me when these third parties take their problem and make it mine via a central credit reporting system that I am forced to be subject to.

GP needs to vent his spleen at the banks and lenders, not 100% innocent bystanders who are being screwed.

Easy... (1)

eth1 (94901) | about 4 years ago | (#32877338)

If you store someone's sensitive information, and their ID is compromised using any of the information you store, you're liable (along with everyone else that stores that info) for reimbursing any costs or lost assets that the victims incur.

As a bonus, this system would be a strong disincentive to storing crap about us that companies don't absolutely require.

How can this problem even exist? (1)

chx1975 (625070) | about 4 years ago | (#32877552)

The chain of events should look like: you go into a bank and ID yourself with a piece of government issued photo id. Then you can open an account or get a mortgage. Otherwise, you can't. Next up, to do a credit transaction when the card is not physically present, you get a text on your mobile phone that you need to send back. Everyone has a goddamned mobile phone capable of sending messages. By the way? This is how it works in many European countries. Also, for online purchases, virtual cards especially one-time virtual card numbers should be used...

Re:How can this problem even exist? (2, Insightful)

sconeu (64226) | about 4 years ago | (#32878458)

What if you're trying to get your first mobile phone?

Re:How can this problem even exist? (0)

Anonymous Coward | about 4 years ago | (#32879016)

What if your phone is stolen? What if someone changes the number that the bank sends the text to? Why should I pay the phone network to buy something online? Why can't I just change my card number if I think it's been stolen?

A reason to use foreign banks... (1)

Radtoo (1646729) | about 4 years ago | (#32881634)

Maybe you should find a bank that will just let you have access with the SSN or such blocked and tell them to let you withdraw with your ATM card or against (nationally issued) ID verification only. You may not have realized this but signatures on checks / credit cards are also ridiculously insecure, same as your SSN.

At worst, you'll only find such a bank account abroads - however, they're easy to find anywhere else but in the US. Put your savings there, use the national account only for more frequent payments - if it only has a few thousand bucks in there and won't allow overdraft, the risk is very limited.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...